The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 apply to every clinic that keeps patient records digitally, including a single-chair practice. The core provisions took effect on 13 November 2025, and full compliance is expected by May 2027.
Under the Act your clinic is the data fiduciary: you decide why and how patient data is used. Your software vendor is a data processor acting on your instructions.
Eight things to put in place
- A plain-language privacy notice at registration that says what you collect, why, and how patients can ask questions.
- Recorded consent for anything beyond treatment, such as WhatsApp reminders or marketing messages.
- Access by role. A receptionist should not see clinical notes they don’t need.
- An audit trail of who opened or changed a record.
- Export on request. Patients can ask for their data; you should be able to hand it over quickly.
- Erasure on request, balanced against how long you must keep clinical records.
- A breach plan: who you call, how you inform patients and the Data Protection Board.
- A written agreement with your software vendor covering security, storage location and breach reporting.
How DentalPin India helps
Consent capture, role-based access, audit logs and full data export are built in. Our India cloud stores data in Mumbai with daily encrypted backups, and we sign a data processing agreement with every clinic.
This article is general guidance, not legal advice. Speak to your lawyer about your clinic’s situation.